Table of Contents

Adding VLANs to a Cluster
Understanding How VTP Works

Understanding the VTP Domain
Upgrading the Switch Software
Understanding VTP Modes and VTP Mode Transitions
Understanding VTP Advertisements
Understanding VTP Version 2
Understanding VTP Pruning
VTP Configuration Guidelines
Default VTP Configuration

Configuring VTP

Configuring a VTP Server
Configuring a VTP Client
Disabling VTP
Enabling VTP Version 2
Disabling VTP Version 2
Monitoring VTP

Understanding How VLANs Work
Adding VLANs to a Cluster

Understanding VLAN Membership
Understanding VLANs in a VTP Domain
Understanding Token Ring VLANs
VLAN Configuration Guidelines
Default VLAN Configurations

Configuring VLANs

Adding an Ethernet VLAN
Modifying an Ethernet VLAN
Deleting a VLAN from the Database
Assigning Static-Access Ports to a VLAN

Configuring VTP and Virtual LANs

This chapter describes how Virtual Trunk Protocol (VTP) works, how you configure it, and how you add VLANs to a VLAN network managed by VTP. For complete syntax and usage information on the commands described in this chapter, refer to the Cisco IOS Desktop Switching Command Reference (online only).

These sections describe how to configure VTP and VLANs:

• "Understanding How VTP Works" section

• "Configuring VTP" section

• "Understanding How VLANs Work" section

• "Configuring VLANs" section

Adding VLANs to a Cluster

Cisco IOS 11.2(8)SA6 supports the grouping of switches into clusters. A cluster is up to 16 switches that can be managed as a single entity. The command switch is the single point of management for the cluster. Member switches are managed through the command switch.

If you are configuring VLANs on a member switch, you might need to enter an extra command from the command switch CLI to access the member switch. When configuring port parameters, for example, you can use the privileged EXEC rcommand command and the member number to display the member switch CLI.

Understanding How VTP Works

Before you create VLANs, you must decide whether to use VTP in your network. Using VTP, you can make configuration changes centrally on a single switch, such as a
Catalyst 2900 series XL, and have those changes automatically communicated to all the other switches in the network. Without VTP, you cannot send information about VLANs to other switches.

VTP is a Layer 2 messaging protocol that maintains VLAN configuration consistency by managing the addition, deletion, and renaming of VLANs on a network-wide basis. VTP minimizes misconfigurations and configuration inconsistencies that can cause several problems, such as duplicate VLAN names, incorrect VLAN-type specifications, and security violations.

Understanding the VTP Domain

A VTP domain (also called a VLAN management domain) is one switch or several interconnected switches sharing the same VTP domain. A switch is configured to be in only one VTP domain. You make global VLAN configuration changes for the domain by using the CLI, Cisco Visual Switch Manager (CVSM) software, or Simple Network Management Protocol (SNMP).

Upgrading the Switch Software

When you upgrade from a software version that supports VLANs but does not support VTP, such as Cisco IOS Release 11.2(8)SA3, to a version that does support VTP, ports that belong to a VLAN retain their VLAN membership, and VTP enters transparent mode. The domain name becomes UPGRADE, and VTP does not propagate the VLAN configuration to other switches.

If you want to propagate the VLAN configuration to other switches, configure the switch to operate as a VTP server, and change the domain name.

Understanding VTP Modes and VTP Mode Transitions

You can configure a supported switch to be in one of the following VTP modes:

• VTP server---In this mode, you can create, modify, and delete VLANs and specify other configuration parameters (such as VTP version) for the entire VTP domain. VTP servers advertise their VLAN configurations to other switches in the same VTP domain and synchronize their VLAN configurations with other switches based on advertisements received over trunk links.

• VTP client---In this mode, VTP clients behave like VTP servers, but you cannot create, change, or delete VLANs on a VTP client.

• VTP transparent---In this mode, VTP transparent switches do not participate in VTP. A VTP transparent switch does not advertise its VLAN configuration and does not synchronize its VLAN configuration based on received advertisements. However, transparent switches do forward VTP advertisements that they receive from other switches. You can create, modify, and delete VLANs.

The "VTP Configuration Guidelines" section provides tips and caveats for configuring VTP.

Understanding VTP Advertisements

Each switch in the VTP domain sends these periodic global configuration advertisements from each trunk port to a reserved multicast address. Neighboring switches receive these advertisements and update their VTP and VLAN configurations as necessary.

The following global domain information is distributed in VTP advertisements:

• VTP domain name

• VTP configuration revision number

• Update identity and update timestamp

• MD5 digest

The following VLAN information is distributed in VTP advertisements for each configured VLAN:

• VLAN ID

• VLAN name

• VLAN type

• VLAN state

• Additional VLAN configuration information specific to the VLAN type

Understanding VTP Version 2

If you use VTP in your network, you must decide whether to use VTP version 1 or version 2. If your environment has Token Ring networks, you must use version 2.

• Token Ring support---VTP version 2 supports Token Ring LAN switching and VLANs (Token Ring Bridge Relay Function [TrBRF] and Token Ring Concentrator Relay Function [TrCRF]). For more information about Token Ring VLANs, refer to the "Understanding How VLANs Work" section.

• Unrecognized Type-Length-Value (TLV) support---A VTP server or client propagates configuration changes to its other trunks, even for TLVs it is not able to parse. The unrecognized TLV is saved in nonvolatile memory when the switch is operating in VTP server mode.

• Version-Dependent Transparent Mode---In VTP version 1, a VTP transparent switch inspects VTP messages for the domain name and version and forwards a message only if the version and domain name match. Because only one domain is supported in the Enterprise Edition Software, VTP version 2 forwards VTP messages in transparent mode without checking the version and domain name.

• Consistency Checks---In VTP version 2, VLAN consistency checks (such as VLAN names and values) are performed only when you enter new information through the CLI, the CVSM software, or SNMP. Consistency checks are not performed when new information is obtained from a VTP message or when information is read from nonvolatile memory. If the digest on a received VTP message is correct, its information is accepted without consistency checks.

Understanding VTP Pruning

Although switches supported by this IOS release are never eligible for VTP pruning, a supported switch does propagate VTP pruning messages. This section describes the role that a supported switch can play in a VTP pruning network.

VTP pruning increases available bandwidth by restricting flooded traffic to those trunk links that the traffic must use to access the appropriate network devices. When VTP pruning is enabled, it can block flooded traffic to VLANs that are included in the pruning-eligible list. Switches supported by this IOS release are never in the pruning-eligible list, and no switch traffic is pruned. Flooding occurs as usual, and switches connected to the
supported switch do not benefit from pruning.

Figure 2-1 shows a switched network with VTP pruning enabled. The broadcast traffic from Switch 1 is not forwarded to Switches 5 and 6 because traffic for the Red VLAN has been pruned on the links indicated (Port 4 on Switch 4). Switch 2 does not prune the traffic destined for Switch 4 or Switch 3.

VTP Configuration Guidelines

Follow these guidelines when implementing VTP in your network:

• All switches in a VTP domain must run the same VTP version.

• The password entered with a domain name should be the same for all switches in the domain.

Caution If you configure a VTP password, the management domain will not function properly if you do not assign the management domain password to each switch in the domain.

• A VTP version 2-capable switch can operate in the same VTP domain as a switch running VTP version 1 provided version 2 is disabled on the version 2-capable switch (version 2 is disabled by default).

• Do not enable VTP version 2 on a switch unless all of the switches in the same VTP domain are version 2-capable. When you enable version 2 on a switch, all of the version 2-capable switches in the domain enable version 2. If there is a version 1-only switch, it will not exchange VTP information with switches with version 2 enabled.

• If there are Token Ring networks in your environment (TrBRF and TrCRF), you must enable VTP version 2 for Token Ring VLAN switching to function properly. To run Token Ring and Token Ring-Net, disable VTP version 2.

• Enabling or disabling VTP pruning on a VTP server enables or disables VTP pruning for the entire management domain.

Default VTP Configuration

Table 2-1 shows the default VTP configuration.

Configuring VTP

You configure VTP by entering commands from the VLAN database configuration command mode. You display the status of VTP by entering the privileged EXEC mode show vtp status command.

When you enter the exit command in VLAN database mode, it applies to all the commands that you entered. VTP messages are sent to other switches in the management domain, and you are returned to privileged EXEC mode.

For more information about these commands, refer to the Cisco IOS Desktop Switching Command Reference.

Configuring a VTP Server

When a switch is in VTP server mode, you can change the VLAN configuration and have it propagate throughout the network. To configure the switch as a VTP server, perform this task from privileged EXEC mode:

This example shows how to enter a VTP domain name and configure the switch as a VTP server:

Switch# vlan database Switch(vlan)# vtp domain Building_A Setting VTP domain name to Building_A Switch(vlan)# vtp domain Building_A password LAVA Domain name already set to Building_A . Setting device VLAN database password to LAVA. Switch(vlan)# vtp server Setting device to VTP SERVER mode. Switch(vlan)# exit APPLY completed. Exiting.... Switch# show vtp status VTP Version : 2 Configuration Revision : 0 Maximum VLANs supported locally : 68 Number of existing VLANs : 6

VTP Operating Mode : Server

VTP Domain Name : Building_A VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x09 0xF6 0x57 0x1C 0xC9 0x6F 0x75 0x16

Configuring a VTP Client

When a switch is in VTP client mode, you cannot change its VLAN configuration. The client switch receives VTP updates from a VTP server in the management domain and then modifies its configuration accordingly.

To configure the switch as a VTP client, perform this task from privileged EXEC mode:

This example shows how to configure the switch as a VTP client and verify the configuration:

Switch# vlan database Switch(vlan)# vtp client Setting device to VTP CLIENT mode. Switch(vlan)# exit In CLIENT state, no apply attempted. Exiting.... Switch# show vtp status VTP Version : 2 Configuration Revision : 0 Maximum VLANs supported locally : 68 Number of existing VLANs : 6


VTP Operating Mode : Client VTP Domain Name : Building_A VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x09 0xF6 0x57 0x1C 0xC9 0x6F 0x75 0x16 Configuration last modified by 172.20.130.40 at 3-5-93 22:15:25

Disabling VTP

When you configure the switch as VTP transparent, you disable VTP on the switch. The switch then does not send VTP updates and does not act on VTP updates received from other switches. However, a VTP transparent switch does forward received VTP advertisements on all of its trunk links.

To put the switch in VTP transparent mode, perform this task from privileged EXEC mode:

This example shows how to configure the switch as VTP transparent and verify the configuration:

Switch# vlan database Switch(vlan)# vtp transparent Setting device to VTP TRANSPARENT mode. Switch(vlan)# exit APPLY completed. Exiting.... Switch# show vtp status VTP Version : 2 Configuration Revision : 0 Maximum VLANs supported locally : 68 Number of existing VLANs : 6


VTP Operating Mode : Transparent VTP Domain Name : Building_A VTP Pruning Mode : Disabled VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x09 0xF6 0x57 0x1C 0xC9 0x6F 0x75 0x16 Configuration last modified by 172.20.130.40 at 3-5-93 22:15:25

Enabling VTP Version 2

VTP version 2 is disabled by default on VTP version 2-capable switches. When you enable VTP version 2 on a switch, every VTP version 2-capable switch in the VTP domain enables version 2.

Caution VTP version 1 and VTP version 2 are not interoperable on switches in the same VTP domain. Every switch in the VTP domain must use the same VTP version. Do not enable VTP version 2 unless every switch in the VTP domain supports version 2.

To enable VTP version 2, perform this task from privileged EXEC mode:

This example shows how to enable VTP version 2 and verify the configuration:

Switch# vlan database Switch(vlan)# vtp v2-mode V2 mode enabled. Switch(vlan)# exit APPLY completed. Exiting.... Switch# show vtp status VTP Version : 2 Configuration Revision : 2 Maximum VLANs supported locally : 68 Number of existing VLANs : 14 VTP Operating Mode : Server VTP Domain Name : milano VTP Pruning Mode : Disabled


VTP V2 Mode : Enabled VTP Traps Generation : Disabled MD5 digest : 0xAC 0x23 0x2F 0x75 0x52 0xDC 0x17 0x70 Configuration last modified by 172.20.128.178 at 3-6-93 23:46:53

Disabling VTP Version 2

To disable VTP version 2, perform this task from privileged EXEC mode:

This example shows how to disable VTP version 2:

Switch# vlan database Switch(vlan)# no vtp v2-mode V2 mode disabled. Switch(vlan)# exit In CLIENT state, no apply attempted. Exiting.... Switch# show vtp status VTP Version : 2 Configuration Revision : 0 Maximum VLANs supported locally : 68 Number of existing VLANs : 59 VTP Operating Mode : Client VTP Domain Name : milano VTP Pruning Mode : Disabled


VTP V2 Mode : Disabled VTP Traps Generation : Disabled MD5 digest : 0x53 0x97 0x06 0x02 0xF8 0x6F 0x45 0x85 Configuration last modified by 172.20.128.151 at 3-5-93 01:05:21

Monitoring VTP

You monitor VTP by displaying its configuration information: the domain name, the current VTP revision, and the number of VLANs. You can also display statistics about the advertisements sent and received by the switch.

Understanding How VLANs Work

A VLAN is a group of end stations with a common set of requirements, independent of physical location. VLANs have the same attributes as a physical LAN, but you can group end stations even if they are not physically located on the same LAN segment.

VLANs on supported switches and other supported devices limit unicast, multicast, and broadcast traffic flooding. Flooded traffic originating from a particular VLAN is only flooded out other ports belonging to that VLAN.

Adding VLANs to a Cluster

Cisco IOS Release 11.2(8)SA6 supports the grouping of switches into clusters. A cluster is up to 16 switches that can be managed as a single entity. The command switch is the single point of management for the cluster. Member switches are managed through the command switch.

Understanding VLAN Membership

Ports that belong to VLANs are configured with a membership mode that determines what kind of traffic each port carries and how many VLANs it can belong to. Table 2-2 lists the membership modes and characteristics.

Understanding VLANs in a VTP Domain

Before you create VLANs, you must decide whether to use VTP to maintain global VLAN configuration information for your network. For complete information on VTP, refer to the "Understanding How VTP Works" section .

Figure 2-2 shows an example of VLANs segmented into logically defined networks.

VLANs are often associated with IP subnetworks. For example, all the end stations in a particular IP subnet belong to the same VLAN. Traffic between VLANs must be routed. Port VLAN membership on the switch is assigned manually on a port-by-port basis. Ports assigned to a VLAN by this method are said to have port-based, or static, VLAN membership.

The "Default VLAN Configurations" section lists the default values and possible ranges for each VLAN media type.

Understanding Token Ring VLANs

Although the Catalyst 2900 series XL and the Catalyst 3500 series XL do not support Token Ring connections, a remote device such as a Catalyst 5000 series switch with Token Ring connections could be managed from one of the supported switches. Switches running this IOS release advertise information about Token Ring VLANs when running VTP
version 2. The following Token Ring VLAN types are supported on the supported switches running VTP version 2:

• Token Ring TrBRF VLANs

• Token Ring TrCRF VLANs

For more information on configuring Token Ring VLANs, see the Catalyst 5000 Series Software Configuration Guide.

VLAN Configuration Guidelines

Follow these guidelines when creating and modifying VLANs in your network:

• A maximum of 250 VLANs can be active on supported switches, and some models only support 64 switches. If VTP reports that there are 254 active VLANs, 4 of the active VLANs (1002 to 1005) are reserved for Token Ring and FDDI.

• Before you can create a VLAN, the switch must be in VTP server mode or VTP transparent mode. For information on configuring VTP, refer to the "Configuring VTP" section.

• Switches running this IOS release do not support Token Ring or FDDI media. The switch does not forward FDDI, FDDI-Net, TrCRF, or TrBRF traffic, but it does propagate the VLAN configuration via VTP.

Default VLAN Configurations

Table 2-3 through Table 2-7 shows the default configurations for the different VLAN media types.

Configuring VLANs

You use the VLAN database command mode to add, change, and delete VLANs. In VTP server or transparent mode, commands to add, change, and delete VLANs are written to the file vlan.dat, and you can display them by entering the privileged EXEC mode show vlan command. The vlan.dat file is stored in nonvolatile memory.

This IOS release increases the number of possible VLANs from 64 to 250 on some switch models. The vlan.dat file is upgraded automatically, but you cannot go back to an earlier version of Cisco IOS after you upgrade to this release.

Caution You can cause inconsistency in the VLAN database if you attempt to manually delete the vlan.dat file. If you want to modify the VLAN configuration or VTP, use the VLAN database commands described in the Cisco IOS Desktop Switching Command Reference.

You use the interface configuration command mode to define the port membership mode and add and remove ports from VLAN. The results of these commands are written to the running-configuration file, and you can display the file by entering the privileged EXEC mode show running-config command.

Adding an Ethernet VLAN

Each VLAN has a unique, 4-digit ID that can be a number from 1 to 1001. To add a VLAN to the VLAN database, assign a number and name to the VLAN. See the "Default VLAN Configurations" section for the list of default parameters that are assigned when you add a VLAN.

If you do not specify the VLAN type, the VLAN is an Ethernet VLAN. To add a VLAN, perform this task from privileged EXEC mode:

This example shows how to create an Ethernet VLAN and verify the configuration:

Modifying an Ethernet VLAN

The following task table illustrates how to modify VLAN parameters. You must perform this task from privileged EXEC mode:

Deleting a VLAN from the Database

When you delete a VLAN from a switch that is in VTP server mode, the VLAN is removed from all switches in the VTP domain. When you delete a VLAN from a switch that is in VTP transparent mode, the VLAN is deleted only on that specific switch.

You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or Token Ring VLANs 1002 to 1005.

Caution When you delete a VLAN, any ports assigned to that VLAN become inactive. They remain associated with the VLAN (and thus inactive) until you assign them to a new VLAN.

To delete a VLAN on the switch, perform this task from privileged EXEC mode:

This example shows how to delete a VLAN:

Switch# vlan database Switch(vlan)# no vlan 3 Deleting VLAN 3... Switch(vlan)# exit APPLY completed. Exiting.... Switch# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- --------------------- 1 default active Fa0/2, Fa0/3, Fa0/4, Fa0/5, Fa0/6, Fa0/7, Fa0/8, Fa0/9, Fa0/10, Fa0/11, Fa0/12, Fa0/13, Fa0/14, Fa0/15, Fa0/16 2 VLAN0002 active 4 VLAN0004 active 1002 fddi-default active 1003 token-ring-default active 1004 fddinet-default active 1005 trnet-default active

Assigning Static-Access Ports to a VLAN

A static-access port belongs to one VLAN. To assign a port to a VLAN, perform this task from privileged EXEC mode:

Switch# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Switch(config)# interface fa0/1 Switch(config-if)# switchport mode access Switch(config-if)# switchport access vlan 0003 Switch(config-if)# end Switch# show interface fa0/1 switchport Name: Fa0/1 Switchport: Enabled Administrative mode: static access


Operational Mode: static access Administrative Trunking Encapsulation: isl Operational Trunking Encapsulation: isl Negotiation of Trunking: Disabled


Access Mode VLAN: 3 (marketing) Trunking Native Mode VLAN: 1 (default) Trunking VLANs Enabled: NONE Pruning VLANs Enabled: NONE

Posted: Wed May 26 12:04:32 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.